{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,1]],"date-time":"2026-04-01T14:37:57Z","timestamp":1775054277685,"version":"3.50.1"},"reference-count":78,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"3","license":[{"start":{"date-parts":[[2015,1,1]],"date-time":"2015-01-01T00:00:00Z","timestamp":1420070400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2015,1,1]],"date-time":"2015-01-01T00:00:00Z","timestamp":1420070400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2015,1,1]],"date-time":"2015-01-01T00:00:00Z","timestamp":1420070400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"name":"Spanish Ministry of Economy and Competitiveness","award":["TEC2012-33754"],"award-info":[{"award-number":["TEC2012-33754"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Commun. Surv. Tutorials"],"published-print":{"date-parts":[[2015]]},"DOI":"10.1109\/comst.2015.2424887","type":"journal-article","created":{"date-parts":[[2015,5,4]],"date-time":"2015-05-04T18:31:51Z","timestamp":1430764311000},"page":"1364-1390","source":"Crossref","is-referenced-by-count":40,"title":["Commodity Packet Capture Engines: Tutorial, Cookbook and Applicability"],"prefix":"10.1109","volume":"17","author":[{"given":"Victor","family":"Moreno","sequence":"first","affiliation":[{"name":"High Performance Comput. & Networking Group, Univ. Autonoma de Madrid, Madrid, Spain"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Javier","family":"Ramos","sequence":"additional","affiliation":[{"name":"High Performance Comput. & Networking Group, Univ. Autonoma de Madrid, Madrid, Spain"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Pedro M.","family":"Santiago del R\u00edo","sequence":"additional","affiliation":[{"name":"High Performance Comput. & Networking Group, Univ. Autonoma de Madrid, Madrid, Spain"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jos\u00e9 Luis","family":"Garc\u00eda-Dorado","sequence":"additional","affiliation":[{"name":"High Performance Comput. & Networking Group, Univ. Autonoma de Madrid, Madrid, Spain"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Francisco J.","family":"Gomez-Arribas","sequence":"additional","affiliation":[{"name":"High Performance Comput. & Networking Group, Univ. Autonoma de Madrid, Madrid, Spain"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Javier","family":"Aracil","sequence":"additional","affiliation":[{"name":"High Performance Comput. & Networking Group, Univ. Autonoma de Madrid, Madrid, Spain"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-71617-4_21"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1109\/INFCOM.2013.6566737"},{"key":"ref71","article-title":"Network monitoring on multicores with algorithmic skeletons","author":"danelutto","year":"0","journal-title":"Proc Int Conf Par"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1145\/2398776.2398784"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1109\/SURV.2008.080406"},{"key":"ref77","author":"systems","year":"2012","journal-title":"White paper Introduction to Cisco IOS netFlow"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1109\/MM.2010.41"},{"key":"ref39","doi-asserted-by":"crossref","first-page":"253","DOI":"10.1109\/LCOMM.2011.122010.102022","article-title":"Why can some advanced Ethernet NICs cause packet reordering?","volume":"15","author":"wenji","year":"2011","journal-title":"IEEE Commun Lett"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1109\/SURV.2009.090304"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1016\/j.comcom.2011.08.003"},{"key":"ref78","first-page":"102","article-title":"Blockmon: Flexible and high-performance big data stream analytics platform and its use cases","volume":"7","author":"dusi","year":"2012","journal-title":"NEC Tech J"},{"key":"ref33","year":"2014","journal-title":"NAPI"},{"key":"ref32","first-page":"1","article-title":"Modelling packet capturing in a traffic monitoring system based on Linux","author":"zabala","year":"0","journal-title":"Proc Symp Perform Eval Comput and Telecommun Syst"},{"key":"ref31","year":"2014","journal-title":"Network analysis module (NAM) products"},{"key":"ref30","year":"2014","journal-title":"Endace EMULEX"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1109\/HPCA.2011.5749734"},{"key":"ref36","author":"benvenuti","year":"2005","journal-title":"Understanding Linux Network Internals"},{"key":"ref35","author":"schroder","year":"2007","journal-title":"Linux Networking Cookbook"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1145\/2018436.2018500"},{"key":"ref60","year":"2015","journal-title":"High-Performance 10G Network Capture Engine"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1016\/j.comcom.2005.07.015"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1002\/nem.1861"},{"key":"ref63","author":"walsworth","year":"2009","journal-title":"The CAIDA Anonymized 2009 Internet Traces"},{"key":"ref28","year":"2014","journal-title":"IXP4XX product line of network processors"},{"key":"ref64","year":"0","journal-title":"Traffic Analysis Research"},{"key":"ref27","year":"2014","journal-title":"APP3000 network"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1145\/354871.354874"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1109\/INFCOM.2012.6195638"},{"key":"ref29","year":"2014","journal-title":"NetFPGA Project"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1002\/nem.1858"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1145\/2046707.2046741"},{"key":"ref69","article-title":"Traffic classification over Gbit speed with commodity hardware","volume":"5","author":"szab\u00f3","year":"2010","journal-title":"J Commun Softw Syst"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1016\/j.jnca.2012.12.020"},{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1109\/TNSM.2012.022412.110184"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2014.2321898"},{"key":"ref22","year":"2015","journal-title":"82599 10 GbE Controller Datasheet"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1145\/1851182.1851207"},{"key":"ref24","author":"woo","year":"2012","journal-title":"Scalable TCP session monitoring with symmetric receive-side scaling"},{"key":"ref23","year":"2015","journal-title":"Receive Side Scaling"},{"key":"ref26","author":"lucent","year":"2014","journal-title":"FP3 Breakthrough 400G Network Processor"},{"key":"ref25","first-page":"1","article-title":"Toward predictable performance in software packet-processing platforms","author":"dobrescu","year":"0","journal-title":"Proc 5th USENIX Symp Netw Syst Des Implementation"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1109\/HPCC.2014.81"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1145\/1629575.1629578"},{"key":"ref59","year":"2014","journal-title":"Intel Data Plane Development Kit (Intel DPDK) Programmer's Guide"},{"key":"ref58","year":"2015","journal-title":"Data-Plane Development Kit"},{"key":"ref57","year":"2015","journal-title":"PFQ homepage"},{"key":"ref56","year":"2014","journal-title":"The fast packet I\/O framework"},{"key":"ref55","year":"2012","journal-title":"Packet I\/O engine"},{"key":"ref54","year":"2014","journal-title":"Libzero for DNA"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1145\/1879141.1879169"},{"key":"ref52","author":"krasnyansky","year":"2012","journal-title":"Uio-ixgbe"},{"key":"ref10","first-page":"174","article-title":"Gigabit rate packet pattern-matching using TCAM","author":"yu","year":"0","journal-title":"Proc 12th IEEE Int Conf Netw Protocols"},{"key":"ref11","first-page":"1","article-title":"Fast regular expression matching using small TCAMs for network intrusion detection and prevention systems","author":"meiners","year":"0","journal-title":"Proc USENIX Conf Security"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1109\/LCOMM.2012.092812.121433"},{"key":"ref12","year":"2014","journal-title":"Packet capture performance evaluation"},{"key":"ref13","year":"2015","journal-title":"Cisco network convergence system"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1145\/1355734.1355746"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1145\/1879141.1879168"},{"key":"ref16","doi-asserted-by":"crossref","first-page":"3","DOI":"10.1007\/978-3-642-36784-7_1","article-title":"High-performance network traffic processing systems using commodity hardware","author":"garc\u00eda-dorado","year":"2013","journal-title":"Data Traffic Monitoring and Analysis"},{"key":"ref17","author":"rizzo","year":"2015","journal-title":"10 Gbit\/s Line Rate Packet Processing Using Commodity Hardware Survey and New Proposals"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1145\/2185376.2185382"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2014.03.007"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1016\/S1389-1286(04)00201-4"},{"key":"ref3","first-page":"599","article-title":"A flow-based method for abnormal network traffic detection","author":"kim","year":"0","journal-title":"Proc IEEE\/IFIP Netw Operat Manag Symp"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/MNET.2003.1248656"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/NOMS.2004.1317735"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/MM.2004.1268997"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/MCOM.2010.5434379"},{"key":"ref49","author":"moreno","year":"2012","journal-title":"Development and evaluation of a low-cost scalable architecture for network traffic capture and storage for 10Gbps networks"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1109\/NOMS.2012.6212025"},{"key":"ref46","first-page":"64","article-title":"On multi-gigabit packet capturing with multi-core commodity hardware","author":"bonelli","year":"0","journal-title":"Proc Passive Active Meas Conf"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/MNET.2014.6786607"},{"key":"ref48","year":"2014","journal-title":"Intel Data Plane Development Kit (Intel DPDK) Release Notes"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1145\/2658260.2658269"},{"key":"ref42","first-page":"1","article-title":"Improving passive packet capture: Beyond device polling","author":"deri","year":"0","journal-title":"Proc of Sys Admin and Net Engin Conf"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1109\/HPCC.2012.75"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1145\/2090147.2103536"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1109\/E2EMON.2005.1564468"}],"container-title":["IEEE Communications Surveys & Tutorials"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/9739\/7214344\/07101227.pdf?arnumber=7101227","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,4,21]],"date-time":"2023-04-21T18:33:27Z","timestamp":1682102007000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/7101227\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2015]]},"references-count":78,"journal-issue":{"issue":"3"},"URL":"https:\/\/doi.org\/10.1109\/comst.2015.2424887","relation":{},"ISSN":["1553-877X","2373-745X"],"issn-type":[{"value":"1553-877X","type":"electronic"},{"value":"2373-745X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2015]]}}}